Retrieve SALT from VALUE and SHA256(value.salt)
#2
32 byte salt is impossible to brute-force, assuming that means 32*8 bits. A little less would still be impossible to brute-force (ie 32*7).

All other security properties are trivially fulfilled under the assumption that SHA-256 is a secure (unbroken) cryptographic hash function.

However, unrelated to the salt itself it would still be possible to know if pass(user A) == pass(user B) due to the deterministic nature of hashes. This can be exploited if user A's password is known (for example because it was part of a previous breach).

note: don't use "encrypted" together with a hash function. A hash functions hashes. Encryption is something different. Encryption is by definition reversible while a hash function is not.


Messages In This Thread
RE: Retrieve SALT from VALUE and SHA256(value.salt) - by undeath - 11-20-2018, 01:48 AM